Buggy code:
@ Singleton public class ExportServlet extends HttpServlet { @ Inject private Provider < User > sessionUser ; @ Inject private Provider < EntityManager > entityManager ; @ Inject private DataService dataService ; @ Inject protected Logger logger ; private SimpleDateFormat requestDateFormat = new SimpleDateFormat ( RESTApiServlet . REQUEST_DATE_PATTERN ) ; @ Transactional @ RequireUser @ Override protected void doGet ( HttpServletRequest req , HttpServletResponse resp ) throws IOException , ServletException { } void checkAccess ( Device device ) { } void csv ( HttpServletResponse response , Device device , Date from , Date to , boolean filter ) throws IOException { } private static String line ( char SEPARATOR , Object ... s ) { } void gpx ( HttpServletResponse response , Device device , Date from , Date to , boolean filter ) throws IOException , XMLStreamException { response . setContentType ( "text//xml;charset=UTF-8" ) ; response . setHeader ( "Content-Disposition" , "attachment;<seq2seq4repair_space>filename=traccar-positions.gpx" ) ; TimeZone tz = TimeZone . getTimeZone ( "UTC" ) ; DateFormat dateFormat = new SimpleDateFormat ( "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'" ) ; dateFormat . setTimeZone ( tz ) ; <START_BUG> XMLStreamWriter xsw = XMLOutputFactory . newFactory ( ) . createXMLStreamWriter ( response . getOutputStream ( ) ) ; <END_BUG> xsw . writeStartDocument ( "UTF-8" , "1.0" ) ; xsw . writeStartElement ( "gpx" ) ; xsw . writeAttribute ( "xmlns" , "http:////www.topografix.com//GPX//1//1" ) ; xsw . writeAttribute ( "xmlns:xsi" , "http:////www.w3.org//2001//XMLSchema-instance" ) ; xsw . writeAttribute ( "xmlns:traccar" , "http:////www.traccar.org" ) ; xsw . writeAttribute ( "creator" , "Traccar<seq2seq4repair_space>WEB<seq2seq4repair_space>UI" ) ; xsw . writeAttribute ( "xsi:schemaLocation" , "http:////www.topografix.com//GPX//1//1<seq2seq4repair_space>http:////www.topografix.com//GPX//1//1//gpx.xsd" ) ; xsw . writeStartElement ( "metadata" ) ; xsw . writeStartElement ( "link" ) ; xsw . writeAttribute ( "href" , "https:////github.com//vitalidze//traccar-web" ) ; xsw . writeStartElement ( "text" ) ; xsw . writeCharacters ( "Traccar<seq2seq4repair_space>WEB<seq2seq4repair_space>UI" ) ; xsw . writeEndElement ( ) ; xsw . writeEndElement ( ) ; xsw . writeStartElement ( "time" ) ; xsw . writeCharacters ( dateFormat . format ( new Date ( ) ) ) ; xsw . writeEndElement ( ) ; xsw . writeEndElement ( ) ; xsw . writeStartElement ( "trk" ) ; xsw . writeStartElement ( "name" ) ; xsw . writeCharacters ( device . getName ( ) ) ; xsw . writeEndElement ( ) ; xsw . writeStartElement ( "desc" ) ; xsw . writeCharacters ( ( ( ( ( ( "Archive<seq2seq4repair_space>records<seq2seq4repair_space>for<seq2seq4repair_space>" + ( device . getName ( ) ) ) + "<seq2seq4repair_space>from<seq2seq4repair_space>" ) + ( dateFormat . format ( from ) ) ) + "<seq2seq4repair_space>to<seq2seq4repair_space>" ) + ( dateFormat . format ( to ) ) ) ) ; xsw . writeEndElement ( ) ; xsw . writeStartElement ( "src" ) ; xsw . writeCharacters ( "Traccar<seq2seq4repair_space>archive" ) ; xsw . writeEndElement ( ) ; xsw . writeStartElement ( "trkseg" ) ; for ( Position p : dataService . getPositions ( device , from , to , filter ) ) { xsw . writeStartElement ( "trkpt" ) ; xsw . writeAttribute ( "lat" , p . getLatitude ( ) . toString ( ) ) ; xsw . writeAttribute ( "lon" , p . getLongitude ( ) . toString ( ) ) ; if ( ( ( p . getAltitude ( ) ) != null ) && ( ( p . getAltitude ( ) ) != 0 ) ) { xsw . writeStartElement ( "ele" ) ; xsw . writeCharacters ( p . getAltitude ( ) . toString ( ) ) ; xsw . writeEndElement ( ) ; } xsw . writeStartElement ( "time" ) ; xsw . writeCharacters ( dateFormat . format ( p . getTime ( ) ) ) ; xsw . writeEndElement ( ) ; xsw . writeStartElement ( "extensions" ) ; if ( ( ( p . getAddress ( ) ) != null ) && ( ! ( p . getAddress ( ) . trim ( ) . isEmpty ( ) ) ) ) { xsw . writeStartElement ( "traccar:address" ) ; xsw . writeCharacters ( StringEscapeUtils . escapeXml ( p . getAddress ( ) ) ) ; xsw . writeEndElement ( ) ; } if ( ( p . getSpeed ( ) ) != null ) { xsw . writeStartElement ( "traccar:speed" ) ; xsw . writeCharacters ( p . getSpeed ( ) . toString ( ) ) ; xsw . writeEndElement ( ) ; } if ( ( p . getCourse ( ) ) != null ) { xsw . writeStartElement ( "traccar:course" ) ; xsw . writeCharacters ( p . getCourse ( ) . toString ( ) ) ; xsw . writeEndElement ( ) ; } if ( ( p . getPower ( ) ) != null ) { xsw . writeStartElement ( "traccar:power" ) ; xsw . writeCharacters ( p . getPower ( ) . toString ( ) ) ; xsw . writeEndElement ( ) ; } if ( ( ( p . getOther ( ) ) != null ) && ( ! ( p . getOther ( ) . trim ( ) . isEmpty ( ) ) ) ) { xsw . writeStartElement ( "traccar:other" ) ; xsw . writeCharacters ( StringEscapeUtils . escapeXml ( p . getOther ( ) ) ) ; xsw . writeEndElement ( ) ; } xsw . writeEndElement ( ) ; xsw . writeEndElement ( ) ; } xsw . writeEndElement ( ) ; xsw . writeEndElement ( ) ; xsw . writeEndElement ( ) ; xsw . writeEndDocument ( ) ; xsw . flush ( ) ; } }

Fix:
XMLStreamWriter xsw = XMLOutputFactory . newFactory ( ) . createXMLStreamWriter ( response . getOutputStream ( ) , "UTF-8" ) ;